AMENDMENTS TO THE CLAIMS 



1.-21. (Cancelled) 

22. (Currently Amended) A method of analyzing resources and events of a computing 
environment first computer comprising: 

(a) storing in a first database located within a the first computer a first dataset 
describing the resource and event characteristics of the first computer at a first 
moment in time; 

(b) storing in the first database a second dataset describing the resource and event 
characteristics of the first computer at a second moment in time; 

(c) comparin g, by an agent of the first computer system, the first dataset and the 
second dataset in order to determine whether the differences indicate the 
occurrence of an exceptional event; and 

(d) if when an exceptional event has occurred, initiatin g by the agent of the first 
computer system an exception handling routine comprising: 

i. establishing communication with an agent executing on a second 
computer, the established communication occurring in a peer-to-peer 
fashion; 

ii. querying the second agent to determine if a substantially similar 
exceptional event occurred at the second computer; and 

iii. receiving a response from the agent of the second computer, the response 
comprising information related to the substantially similar exceptional 
event. 



23. (Cancelled) 
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24. (Currently Amended) The method of claim 22 wherein initiating an exception handling 
routine further comprises notifying a human user of the exceptional even t at the first 
computer . 

25. (Currently Amended) The method of claim 223- wherein the second computer further 
compringses notifying a server of the occurrence of an exceptional event at the first 
computer . 

26. (Cancelled) 

27. (Currently Amended) The method of claim 226, further comprising the step: (f) the 
second computer storinges the a notification of the exceptional event in a second 
database. 

28. (Currently Amended) The method of claim 22-7, further comprising the stop: (g) the 
second computer storinges the response in the first second database. 

29. (Cancelled) 

30. (Cancelled) 

31. (Cancelled) 

32. (Cancelled) 

33. (New) The method of claim 27 wherein the storing comprises, storing the notification of 
the exceptional event in the second database, the second database being located at the 
second computer. 

34. (New) The method of claim 22 wherein receiving a response from the agent of the 
second computer comprises, receiving instructions from the second computer, the 
instructions comprising an action to be taken by the first computer in response the 
exceptional event. 
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35. 



(New) The method of claim 28 further comprising storing the response in the a second 
database, the second database being located at a server. 



36. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one process executing on the first computer. 

37. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one system resource executing on the first computer. 

38. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one application event occurring on the first computer. 

39. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one end-user action executed on the first computer. 

40. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one operating system event occurring on the first 
computer. 

41. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network system in communication with 
the first computer. 

42. (New) The method of claim 22 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network resource in communication with 
the first computer. 

43. (New) The method of claim 22 further comprising: 

iv. establishing communication with an agent executing on a third 
computer, the established communication occurring in a peer-to-peer 
fashion between the second computer and the third computer; 

v. querying the third agent to determine if a substantially similar exceptional 
event occurred at the third computer; and 
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vi. receiving a response from the agent of the third computer, the response 
comprising information related to the substantially similar exceptional 
event. 

44. (New) The method of claim 43 wherein the receiving a response from the agent of 
second computer comprises receiving a response from the agent of the second computer 
wherein the response comprises the response from the agent of the third computer. 

45. (New) The method of claim 22 receiving a response from the agent of the second 
computer comprises, receiving a response after the agent of the second computer 
compares a first dataset and a second data set stored in a database of the second computer 
to determine whether the exceptional event occurred at the second computer. 

46. (New) The method of claim 22 wherein receiving a response from the agent of the 
second computer comprises, receiving a response from a server storing an aggregation of 
exceptional events from a plurality of agents each executing on a respective computer. 

47. (New) A system for analyzing resources and events of a computing environment, the 
system comprising: 

a first computer comprising a first database that stores a plurality of datasets that 
described resource and event characteristics of the first computer at respective 
moments in time; and 

an agent in communication with the first computer, the agent comparing at least 
two respective datasets of the database to determine whether the differences between 
the datasets indicate the occurrence of an exceptional event and initiating an 
exception handling routine when the difference indicate an exceptional event 
occurred, the exception handling routine comprising: 

establishing peer-to-peer communication with an agent executing on a 
second computer; 
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querying the second agent to determine if a substantially similar exceptional 
event occurred at the second computer; and 

receiving a response from the agent of the second computer, the response 
comprising information related to the substantially similar exceptional event. 

48. (New) The system of claim 47 wherein the exception handling routine further comprises 
notifying a human user of the exceptional event. 

49. (New) The system of claim 47 wherein the exception handling routine further comprises 
notifying a server of the exceptional event. 

50. (New) The system of claim 47 wherein the first database stores the occurrence of the 
exceptional event therein. 

51. (New) The system of claim 47 wherein the first database stores the response therein. 

52. (New) The system of claim 47 wherein the agent transmits the occurrence of the 
exceptional event to the second computer and wherein the second computer stores the 
exceptional event in a second database associated with the second computer. 

53. (New) The system of claim 52 wherein the second computer is a server. 

54. (New) The system of claim 47 wherein the response comprises instructions to execute in 
response to the occurrence of the exceptional event. 

55. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one process executing on the first computer. 

56. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one system resource executing on the first computer. 

57. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one application event occurring on the first computer. 
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58. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one end-user action executed on the first computer. 

59. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one operating system event occurring on the first 
computer. 

60. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network system in communication with 
the first computer. 

61. (New) The system of claim 47 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network resource in communication with 
the first computer. 

62. (New) The system of claim 47 wherein the exception handling routine further comprises: 

establishing communication with an agent executing on a third computer, the 
established communication occurring in a peer-to-peer fashion between the 
second computer and the third computer; 

querying the third agent to determine if a substantially similar exceptional 
event occurred at the third computer; and 

receiving a response from the agent of the third computer, the response 
comprising information related to the substantially similar exceptional event. 

63. (New) The system of claim 62 wherein the response received from the second computer 
comprises the response from the third computer. 

64. (New) The system of claim 47 wherein the agent of the second computer compares at 
least two respective datasets of a second database to determine whether the differences 
between the datasets indicate the occurrence of a substantially similar exceptional event. 
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65. (New) The system of claim 47 wherein the response received from the second computer 
comprises a response from a server storing an aggregation of exceptional events from a 
plurality of agents each executing on a respective computer. 



66. (New) A system for analyzing resources and events of a computing environment, the 
system comprising: 

(a) means for storing in a first database located within a the first computer a first 
dataset describing the resource and event characteristics of the first computer at a 
first moment in time; 

(b) means for storing in the first database a second dataset describing the resource 
and event characteristics of the first computer at a second moment in time; 

(c) means for comparing, the first dataset and the second dataset in order to 
determine whether the differences indicate the occurrence of an exceptional 
event; and 

(d) when an exceptional event has occurred, initiating means for executing an 
exception handling routine, the routine comprising: 

i. establishing communication with an agent executing on a second 
computer, the established communication occurring in a peer-to-peer 
fashion; 

ii. querying the second agent to determine if a substantially similar 
exceptional event occurred at the second computer; and 

iii. receiving a response from the agent of the second computer, the response 
comprising information related to the substantially similar exceptional 
event. 

67. (New) The system of claim 66 wherein the exception handling routine further comprises 
notifying a human user of the exceptional event at the first computer. 
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68. (New) The system of claim 66 wherein the exception handling routine further comprises 
notifying a server of the occurrence of an exceptional event at the first computer. 

69. (New) The system of claim 66 further comprising means for storing the notification of 
the exceptional event in a second database. 

70. (New) The system of claim 66 further comprising means for storing the response in the 
first database. 

71. (New) The system of claim 66 further comprising means for storing the notification of 
the exceptional event in the second database, the second database being located at the 
second computer. 

72. (New) The system of claim 66 wherein the instructions received from the second 
computer comprise an action to be taken by the first computer in response the 
exceptional event. 

73. (New) The system of claim 66 further comprising means for storing the response in the a 
second database, the second database being located at a server. 

74. (New) The system of claim 66 wherein the resources and event characteristics of the 
first computing device comprise at least one process executing on the first computer. 

75. (New) The system of claim 66 wherein the resources and event characteristics of the 
first computing device comprise at least one system resource executing on the first 
computer. 

76. (New) The system of claim 66 wherein the resources and event characteristics of the first 
computing device comprise at least one application event occurring on the first computer. 

77. (New) The system of claim 66 wherein the resources and event characteristics of the first 
computing device comprise at least one end-user action executed on the first computer. 
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78. (New) The system of claim 66 wherein the resources and event characteristics of the first 
computing device comprise at least one operating system event occurring on the first 
computer. 

79. (New) The system of claim 66 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network system in communication with 
the first computer. 

80. (New) The system of claim 66 wherein the resources and event characteristics of the first 
computing device comprise at least one shared network resource in communication with 
the first computer. 

81. (New) The system of claim 66 wherein the exception handling routine further comprises: 

iv. establishing communication with an agent executing on a third 
computer, the established communication occurring in a peer-to-peer 
fashion between the second computer and the third computer; 

v. querying the third agent to determine if a substantially similar exceptional 
event occurred at the third computer; and 

vi. receiving a response from the agent of the third computer, the response 
comprising information related to the substantially similar exceptional 
event. 

82. (New) The system of claim 81 wherein the receiving a response from the agent of 
second computer comprises receiving a response from the agent of the second computer 
wherein the response comprises the response from the agent of the third computer. 

83. (New) The system of claim 66 receiving a response from the agent of the second 
computer comprises, receiving a response after the agent of the second computer 
compares a first dataset and a second data set stored in a database of the second computer 
to determine whether the exceptional event occurred at the second computer. 
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84. (New) The system of claim 66 wherein receiving a response from the agent of the 

second computer comprises, receiving a response from a server storing an aggregation of 
exceptional events from a plurality of agents each executing on a respective computer. 
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